Replika and Italy's regulator: a privacy checklist

What Italy's regulator found

Italy’s data regulator, Garante, announced an action against Luka on 2025-05-19 following its earlier Replika investigation. The announcement describes concerns about the basis for processing, privacy information and age checks. The fine of €5 million is approx. RM22.89 million at the 21 October 2026 reference rate.

The underlying decision is dated 2025-04-10; the earlier temporary measure was dated 2023-02-02. Keep the decision date separate from the press-release date. The official page notes an opposition proceeding concerning publication of the order. We do not infer the final outcome of any appeal from that note.

The practical Replika privacy lesson is to inspect the current notice and controls rather than assuming an old action describes every present feature. A provider’s revised policy is evidence of stated practices, not an independent infrastructure audit. Searches for “is replika safe”, “replika fine” or “replika italy” should lead to dated facts and specific controls, not a blanket promise about confidentiality.

See also: spicy ai

Keep the historical findings separate from present-day policy statements, and record the date of each source you compare.

Six checks for any companion app

Six checks for any companion app start with the identity of the controller. Record the legal operator and a contact route; a brand name alone does not identify who handles a data request. Next, check age eligibility and the mechanism described for enforcing it. A statement that a service is for adults is different from a documented verification flow.

Third, identify the account-deletion route and distinguish it from hiding a chat or cancelling a subscription. Fourth, find the exact language about model training, service improvement and any opt-out. A marketing unsubscribe is not a training control. Fifth, examine human review, including flagged material, quality checks and support access. Encryption does not itself answer that access question.

The sixth check is retention: ask which categories are kept, for how long, and what exceptions follow account deletion. A single log-retention period should not be applied to all chat content. These checks are an editorial comparison framework, not an instruction to disclose more personal information to establish identity. Use the provider’s published request process and provide only what that process requires.

See also: Replika review · Candy AI

Five apps against the checklist

Five apps against the checklist cannot be reduced to a privacy league table. “Not disclosed” means the app’s documents don’t mention it; “Not confirmed” means we could not find enough evidence either way. Neither status proves that the feature does not exist. The table is dated 21 October 2026 and is based on each app’s privacy policy and help pages.

Candy’s notice discusses training and review of de-identified interactions. Replika documents account deletion in settings and category-specific retention. Kindroid describes deletion and retention but its memory switches do not by themselves establish a general training opt-out. Character AI has official deletion instructions, but its policy page did not load when we checked. Janitor’s relevant official material could not be reopened, so its cells remain unresolved.

Compare the exact question in each column before choosing a service. An account-deletion control does not promise immediate deletion of all legally retained records. A limited statement about human review does not establish that every employee can read every conversation. The table records what was supported, without treating missing evidence as either a selling point or a finding of wrongdoing.

See also: Janitor AI · AI chat privacy settings

What this means for you

Run the six checks on any companion app before you share anything personal: who the operator is, how age is checked, how to delete the account, whether chats train models, who reviews flagged content and how long data is kept. If an app doesn’t answer one of them, treat that as a reason for caution, not as a “no”.

See also: responsible use